Description
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | ceph | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 13 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 12 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 9 | ceph | 10.2.11-1 | DSA-4339-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 4 | ceph +1 | 10.2.10+git.1507616349.698469bd8d-12.6.1 | SUSE-SU-2017:2922-1 |
| SUSE Enterprise Storage 3 | ceph | 10.2.10+git.1510313171.6d5f0aeac1-13.7.3 | SUSE-SU-2017:3171-1 |
| SUSE Enterprise Storage 3 | ceph-test | 10.2.10+git.1510313171.6d5f0aeac1-13.7.2 | SUSE-SU-2017:3171-1 |
Advisories 3
- DSA-4339-1 ceph - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:3171-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2922-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 99075 vdb-entry
- DSA-4339 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7519